Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. An encrypted stream of packets is received, with the encryption obscuring the type of data within the stream of packets. The type of data contained within the encrypted stream of packets is inferred using at least one of i) a set of variables comprising at least one of an observable parameter, a threshold value, a range of values, a timer, and an algorithm, and ii) multiple processes. Varying the selection of the variables thwarts hacking attempts, and the multiple processes enhance effectiveness and reliability.